Vulnerabilities > CVE-2012-1954 - Resource Management Errors vulnerability in Mozilla products

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
mozilla
CWE-399
critical
nessus

Summary

Use-after-free vulnerability in the nsDocument::AdoptNode function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via vectors involving multiple adoptions and empty documents.

Vulnerable Configurations

Part Description Count
Application
Mozilla
181

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20120717_THUNDERBIRD_ON_SL5_X.NASL
    descriptionMozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962, CVE-2012-1967) Malicious content could bypass same-compartment security wrappers (SCSW) and execute arbitrary code with chrome privileges. (CVE-2012-1959) A flaw in the way Thunderbird called history.forward and history.back could allow an attacker to conceal a malicious URL, possibly tricking a user into believing they are viewing trusted content. (CVE-2012-1955) A flaw in a parser utility class used by Thunderbird to parse feeds (such as RSS) could allow an attacker to execute arbitrary JavaScript with the privileges of the user running Thunderbird. This issue could have affected other Thunderbird components or add-ons that assume the class returns sanitized input. (CVE-2012-1957) A flaw in the way Thunderbird handled X-Frame-Options headers could allow malicious content to perform a clickjacking attack. (CVE-2012-1961) A flaw in the way Content Security Policy (CSP) reports were generated by Thunderbird could allow malicious content to steal a victim
    last seen2020-03-18
    modified2012-08-01
    plugin id61367
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61367
    titleScientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20120717)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61367);
      script_version("1.7");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2012-1948", "CVE-2012-1951", "CVE-2012-1955", "CVE-2012-1957", "CVE-2012-1958", "CVE-2012-1959", "CVE-2012-1961", "CVE-2012-1962", "CVE-2012-1963", "CVE-2012-1964", "CVE-2012-1967");
    
      script_name(english:"Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20120717)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla Thunderbird is a standalone mail and newsgroup client.
    
    Several flaws were found in the processing of malformed content.
    Malicious content could cause Thunderbird to crash or, potentially,
    execute arbitrary code with the privileges of the user running
    Thunderbird. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952,
    CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962,
    CVE-2012-1967)
    
    Malicious content could bypass same-compartment security wrappers
    (SCSW) and execute arbitrary code with chrome privileges.
    (CVE-2012-1959)
    
    A flaw in the way Thunderbird called history.forward and history.back
    could allow an attacker to conceal a malicious URL, possibly tricking
    a user into believing they are viewing trusted content.
    (CVE-2012-1955)
    
    A flaw in a parser utility class used by Thunderbird to parse feeds
    (such as RSS) could allow an attacker to execute arbitrary JavaScript
    with the privileges of the user running Thunderbird. This issue could
    have affected other Thunderbird components or add-ons that assume the
    class returns sanitized input. (CVE-2012-1957)
    
    A flaw in the way Thunderbird handled X-Frame-Options headers could
    allow malicious content to perform a clickjacking attack.
    (CVE-2012-1961)
    
    A flaw in the way Content Security Policy (CSP) reports were generated
    by Thunderbird could allow malicious content to steal a victim's OAuth
    2.0 access tokens and OpenID credentials. (CVE-2012-1963)
    
    A flaw in the way Thunderbird handled certificate warnings could allow
    a man-in-the-middle attacker to create a crafted warning, possibly
    tricking a user into accepting an arbitrary certificate as trusted.
    (CVE-2012-1964)
    
    A previous nss update introduced a mitigation for the CVE-2011-3389
    flaw. For compatibility reasons, it remains disabled by default in the
    nss packages. This update makes Thunderbird enable the mitigation by
    default. It can be disabled by setting the NSS_SSL_CBC_RANDOM_IV
    environment variable to 0 before launching Thunderbird.
    
    Note: None of the issues in this advisory can be exploited by a
    specially crafted HTML mail message as JavaScript is disabled by
    default for mail messages. They could be exploited another way in
    Thunderbird, for example, when viewing the full remote content of an
    RSS feed.
    
    All Thunderbird users should upgrade to this updated package, which
    contains Thunderbird version 10.0.6 ESR, which corrects these issues.
    After installing the update, Thunderbird must be restarted for the
    changes to take effect."
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1207&L=scientific-linux-errata&T=0&P=5041
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?0d45e8a9"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Update the affected thunderbird and / or thunderbird-debuginfo
    packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:thunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:thunderbird-debuginfo");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/07/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/07/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 6.x", "Scientific Linux " + os_ver);
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL5", reference:"thunderbird-10.0.6-1.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"thunderbird-debuginfo-10.0.6-1.el5_8")) flag++;
    
    if (rpm_check(release:"SL6", reference:"thunderbird-10.0.6-1.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"thunderbird-debuginfo-10.0.6-1.el6_3")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "thunderbird / thunderbird-debuginfo");
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2012-1088.NASL
    descriptionFrom Red Hat Security Advisory 2012:1088 : Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962, CVE-2012-1967) A malicious web page could bypass same-compartment security wrappers (SCSW) and execute arbitrary code with chrome privileges. (CVE-2012-1959) A flaw in the context menu functionality in Firefox could allow a malicious website to bypass intended restrictions and allow a cross-site scripting attack. (CVE-2012-1966) A page different to that in the address bar could be displayed when dragging and dropping to the address bar, possibly making it easier for a malicious site or user to perform a phishing attack. (CVE-2012-1950) A flaw in the way Firefox called history.forward and history.back could allow an attacker to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site. (CVE-2012-1955) A flaw in a parser utility class used by Firefox to parse feeds (such as RSS) could allow an attacker to execute arbitrary JavaScript with the privileges of the user running Firefox. This issue could have affected other browser components or add-ons that assume the class returns sanitized input. (CVE-2012-1957) A flaw in the way Firefox handled X-Frame-Options headers could allow a malicious website to perform a clickjacking attack. (CVE-2012-1961) A flaw in the way Content Security Policy (CSP) reports were generated by Firefox could allow a malicious web page to steal a victim
    last seen2020-05-31
    modified2013-07-12
    plugin id68578
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68578
    titleOracle Linux 5 / 6 : firefox (ELSA-2012-1088)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2012:1088 and 
    # Oracle Linux Security Advisory ELSA-2012-1088 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(68578);
      script_version("1.9");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/29");
    
      script_cve_id("CVE-2012-1948", "CVE-2012-1950", "CVE-2012-1951", "CVE-2012-1952", "CVE-2012-1953", "CVE-2012-1954", "CVE-2012-1955", "CVE-2012-1957", "CVE-2012-1958", "CVE-2012-1959", "CVE-2012-1961", "CVE-2012-1962", "CVE-2012-1963", "CVE-2012-1964", "CVE-2012-1965", "CVE-2012-1966", "CVE-2012-1967");
      script_xref(name:"RHSA", value:"2012:1088");
    
      script_name(english:"Oracle Linux 5 / 6 : firefox (ELSA-2012-1088)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "From Red Hat Security Advisory 2012:1088 :
    
    Updated firefox packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 5 and 6.
    
    The Red Hat Security Response Team has rated this update as having
    critical security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    Mozilla Firefox is an open source web browser. XULRunner provides the
    XUL Runtime environment for Mozilla Firefox.
    
    A web page containing malicious content could cause Firefox to crash
    or, potentially, execute arbitrary code with the privileges of the
    user running Firefox. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952,
    CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962,
    CVE-2012-1967)
    
    A malicious web page could bypass same-compartment security wrappers
    (SCSW) and execute arbitrary code with chrome privileges.
    (CVE-2012-1959)
    
    A flaw in the context menu functionality in Firefox could allow a
    malicious website to bypass intended restrictions and allow a
    cross-site scripting attack. (CVE-2012-1966)
    
    A page different to that in the address bar could be displayed when
    dragging and dropping to the address bar, possibly making it easier
    for a malicious site or user to perform a phishing attack.
    (CVE-2012-1950)
    
    A flaw in the way Firefox called history.forward and history.back
    could allow an attacker to conceal a malicious URL, possibly tricking
    a user into believing they are viewing a trusted site. (CVE-2012-1955)
    
    A flaw in a parser utility class used by Firefox to parse feeds (such
    as RSS) could allow an attacker to execute arbitrary JavaScript with
    the privileges of the user running Firefox. This issue could have
    affected other browser components or add-ons that assume the class
    returns sanitized input. (CVE-2012-1957)
    
    A flaw in the way Firefox handled X-Frame-Options headers could allow
    a malicious website to perform a clickjacking attack. (CVE-2012-1961)
    
    A flaw in the way Content Security Policy (CSP) reports were generated
    by Firefox could allow a malicious web page to steal a victim's OAuth
    2.0 access tokens and OpenID credentials. (CVE-2012-1963)
    
    A flaw in the way Firefox handled certificate warnings could allow a
    man-in-the-middle attacker to create a crafted warning, possibly
    tricking a user into accepting an arbitrary certificate as trusted.
    (CVE-2012-1964)
    
    A flaw in the way Firefox handled feed:javascript URLs could allow
    output filtering to be bypassed, possibly leading to a cross-site
    scripting attack. (CVE-2012-1965)
    
    The nss update RHBA-2012:0337 for Red Hat Enterprise Linux 5 and 6
    introduced a mitigation for the CVE-2011-3389 flaw. For compatibility
    reasons, it remains disabled by default in the nss packages. This
    update makes Firefox enable the mitigation by default. It can be
    disabled by setting the NSS_SSL_CBC_RANDOM_IV environment variable to
    0 before launching Firefox. (BZ#838879)
    
    For technical details regarding these flaws, refer to the Mozilla
    security advisories for Firefox 10.0.6 ESR. You can find a link to the
    Mozilla advisories in the References section of this erratum.
    
    Red Hat would like to thank the Mozilla project for reporting these
    issues. Upstream acknowledges Benoit Jacob, Jesse Ruderman, Christian
    Holler, Bill McCloskey, Abhishek Arya, Arthur Gerkis, Bill Keese,
    moz_bug_r_a4, Bobby Holley, Code Audit Labs, Mariusz Mlynski, Mario
    Heiderich, Frederic Buclin, Karthikeyan Bhargavan, Matt McCutchen,
    Mario Gomes, and Soroush Dalili as the original reporters of these
    issues.
    
    All Firefox users should upgrade to these updated packages, which
    contain Firefox version 10.0.6 ESR, which corrects these issues. After
    installing the update, Firefox must be restarted for the changes to
    take effect."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2012-July/002939.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2012-July/002944.html"
      );
      script_set_attribute(
        attribute:"solution",
        value:"Update the affected firefox packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:xulrunner");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:xulrunner-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/07/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/07/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(5|6)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 5 / 6", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL5", reference:"firefox-10.0.6-1.0.1.el5_8", allowmaj:TRUE)) flag++;
    if (rpm_check(release:"EL5", reference:"xulrunner-10.0.6-2.0.1.el5_8")) flag++;
    if (rpm_check(release:"EL5", reference:"xulrunner-devel-10.0.6-2.0.1.el5_8")) flag++;
    
    if (rpm_check(release:"EL6", reference:"firefox-10.0.6-1.0.1.el6_3", allowmaj:TRUE)) flag++;
    if (rpm_check(release:"EL6", reference:"xulrunner-10.0.6-1.0.1.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"xulrunner-devel-10.0.6-1.0.1.el6_3")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox / xulrunner / xulrunner-devel");
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2012-1089.NASL
    descriptionFrom Red Hat Security Advisory 2012:1089 : An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962, CVE-2012-1967) Malicious content could bypass same-compartment security wrappers (SCSW) and execute arbitrary code with chrome privileges. (CVE-2012-1959) A flaw in the way Thunderbird called history.forward and history.back could allow an attacker to conceal a malicious URL, possibly tricking a user into believing they are viewing trusted content. (CVE-2012-1955) A flaw in a parser utility class used by Thunderbird to parse feeds (such as RSS) could allow an attacker to execute arbitrary JavaScript with the privileges of the user running Thunderbird. This issue could have affected other Thunderbird components or add-ons that assume the class returns sanitized input. (CVE-2012-1957) A flaw in the way Thunderbird handled X-Frame-Options headers could allow malicious content to perform a clickjacking attack. (CVE-2012-1961) A flaw in the way Content Security Policy (CSP) reports were generated by Thunderbird could allow malicious content to steal a victim
    last seen2020-05-31
    modified2013-07-12
    plugin id68579
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68579
    titleOracle Linux 6 : thunderbird (ELSA-2012-1089)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2012:1089 and 
    # Oracle Linux Security Advisory ELSA-2012-1089 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(68579);
      script_version("1.11");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/29");
    
      script_cve_id("CVE-2012-1948", "CVE-2012-1951", "CVE-2012-1952", "CVE-2012-1953", "CVE-2012-1954", "CVE-2012-1955", "CVE-2012-1957", "CVE-2012-1958", "CVE-2012-1959", "CVE-2012-1961", "CVE-2012-1962", "CVE-2012-1963", "CVE-2012-1964", "CVE-2012-1967");
      script_xref(name:"RHSA", value:"2012:1089");
    
      script_name(english:"Oracle Linux 6 : thunderbird (ELSA-2012-1089)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Oracle Linux host is missing a security update."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "From Red Hat Security Advisory 2012:1089 :
    
    An updated thunderbird package that fixes multiple security issues is
    now available for Red Hat Enterprise Linux 5 and 6.
    
    The Red Hat Security Response Team has rated this update as having
    critical security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    Mozilla Thunderbird is a standalone mail and newsgroup client.
    
    Several flaws were found in the processing of malformed content.
    Malicious content could cause Thunderbird to crash or, potentially,
    execute arbitrary code with the privileges of the user running
    Thunderbird. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952,
    CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962,
    CVE-2012-1967)
    
    Malicious content could bypass same-compartment security wrappers
    (SCSW) and execute arbitrary code with chrome privileges.
    (CVE-2012-1959)
    
    A flaw in the way Thunderbird called history.forward and history.back
    could allow an attacker to conceal a malicious URL, possibly tricking
    a user into believing they are viewing trusted content.
    (CVE-2012-1955)
    
    A flaw in a parser utility class used by Thunderbird to parse feeds
    (such as RSS) could allow an attacker to execute arbitrary JavaScript
    with the privileges of the user running Thunderbird. This issue could
    have affected other Thunderbird components or add-ons that assume the
    class returns sanitized input. (CVE-2012-1957)
    
    A flaw in the way Thunderbird handled X-Frame-Options headers could
    allow malicious content to perform a clickjacking attack.
    (CVE-2012-1961)
    
    A flaw in the way Content Security Policy (CSP) reports were generated
    by Thunderbird could allow malicious content to steal a victim's OAuth
    2.0 access tokens and OpenID credentials. (CVE-2012-1963)
    
    A flaw in the way Thunderbird handled certificate warnings could allow
    a man-in-the-middle attacker to create a crafted warning, possibly
    tricking a user into accepting an arbitrary certificate as trusted.
    (CVE-2012-1964)
    
    The nss update RHBA-2012:0337 for Red Hat Enterprise Linux 5 and 6
    introduced a mitigation for the CVE-2011-3389 flaw. For compatibility
    reasons, it remains disabled by default in the nss packages. This
    update makes Thunderbird enable the mitigation by default. It can be
    disabled by setting the NSS_SSL_CBC_RANDOM_IV environment variable to
    0 before launching Thunderbird. (BZ#838879)
    
    Red Hat would like to thank the Mozilla project for reporting these
    issues. Upstream acknowledges Benoit Jacob, Jesse Ruderman, Christian
    Holler, Bill McCloskey, Abhishek Arya, Arthur Gerkis, Bill Keese,
    moz_bug_r_a4, Bobby Holley, Mariusz Mlynski, Mario Heiderich, Frederic
    Buclin, Karthikeyan Bhargavan, and Matt McCutchen as the original
    reporters of these issues.
    
    Note: None of the issues in this advisory can be exploited by a
    specially crafted HTML mail message as JavaScript is disabled by
    default for mail messages. They could be exploited another way in
    Thunderbird, for example, when viewing the full remote content of an
    RSS feed.
    
    All Thunderbird users should upgrade to this updated package, which
    contains Thunderbird version 10.0.6 ESR, which corrects these issues.
    After installing the update, Thunderbird must be restarted for the
    changes to take effect."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2012-July/002940.html"
      );
      script_set_attribute(
        attribute:"solution",
        value:"Update the affected thunderbird package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:thunderbird");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/07/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/07/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 6", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL6", reference:"thunderbird-10.0.6-1.0.1.el6_3", allowmaj:TRUE)) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "thunderbird");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2012-1089.NASL
    descriptionAn updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962, CVE-2012-1967) Malicious content could bypass same-compartment security wrappers (SCSW) and execute arbitrary code with chrome privileges. (CVE-2012-1959) A flaw in the way Thunderbird called history.forward and history.back could allow an attacker to conceal a malicious URL, possibly tricking a user into believing they are viewing trusted content. (CVE-2012-1955) A flaw in a parser utility class used by Thunderbird to parse feeds (such as RSS) could allow an attacker to execute arbitrary JavaScript with the privileges of the user running Thunderbird. This issue could have affected other Thunderbird components or add-ons that assume the class returns sanitized input. (CVE-2012-1957) A flaw in the way Thunderbird handled X-Frame-Options headers could allow malicious content to perform a clickjacking attack. (CVE-2012-1961) A flaw in the way Content Security Policy (CSP) reports were generated by Thunderbird could allow malicious content to steal a victim
    last seen2020-05-31
    modified2012-07-18
    plugin id60009
    published2012-07-18
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60009
    titleRHEL 5 / 6 : thunderbird (RHSA-2012:1089)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2012:1089. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(60009);
      script_version ("1.24");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/29");
    
      script_cve_id("CVE-2012-1948", "CVE-2012-1951", "CVE-2012-1952", "CVE-2012-1953", "CVE-2012-1954", "CVE-2012-1955", "CVE-2012-1957", "CVE-2012-1958", "CVE-2012-1959", "CVE-2012-1961", "CVE-2012-1962", "CVE-2012-1963", "CVE-2012-1964", "CVE-2012-1967");
      script_xref(name:"RHSA", value:"2012:1089");
    
      script_name(english:"RHEL 5 / 6 : thunderbird (RHSA-2012:1089)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "An updated thunderbird package that fixes multiple security issues is
    now available for Red Hat Enterprise Linux 5 and 6.
    
    The Red Hat Security Response Team has rated this update as having
    critical security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    Mozilla Thunderbird is a standalone mail and newsgroup client.
    
    Several flaws were found in the processing of malformed content.
    Malicious content could cause Thunderbird to crash or, potentially,
    execute arbitrary code with the privileges of the user running
    Thunderbird. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952,
    CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962,
    CVE-2012-1967)
    
    Malicious content could bypass same-compartment security wrappers
    (SCSW) and execute arbitrary code with chrome privileges.
    (CVE-2012-1959)
    
    A flaw in the way Thunderbird called history.forward and history.back
    could allow an attacker to conceal a malicious URL, possibly tricking
    a user into believing they are viewing trusted content.
    (CVE-2012-1955)
    
    A flaw in a parser utility class used by Thunderbird to parse feeds
    (such as RSS) could allow an attacker to execute arbitrary JavaScript
    with the privileges of the user running Thunderbird. This issue could
    have affected other Thunderbird components or add-ons that assume the
    class returns sanitized input. (CVE-2012-1957)
    
    A flaw in the way Thunderbird handled X-Frame-Options headers could
    allow malicious content to perform a clickjacking attack.
    (CVE-2012-1961)
    
    A flaw in the way Content Security Policy (CSP) reports were generated
    by Thunderbird could allow malicious content to steal a victim's OAuth
    2.0 access tokens and OpenID credentials. (CVE-2012-1963)
    
    A flaw in the way Thunderbird handled certificate warnings could allow
    a man-in-the-middle attacker to create a crafted warning, possibly
    tricking a user into accepting an arbitrary certificate as trusted.
    (CVE-2012-1964)
    
    The nss update RHBA-2012:0337 for Red Hat Enterprise Linux 5 and 6
    introduced a mitigation for the CVE-2011-3389 flaw. For compatibility
    reasons, it remains disabled by default in the nss packages. This
    update makes Thunderbird enable the mitigation by default. It can be
    disabled by setting the NSS_SSL_CBC_RANDOM_IV environment variable to
    0 before launching Thunderbird. (BZ#838879)
    
    Red Hat would like to thank the Mozilla project for reporting these
    issues. Upstream acknowledges Benoit Jacob, Jesse Ruderman, Christian
    Holler, Bill McCloskey, Abhishek Arya, Arthur Gerkis, Bill Keese,
    moz_bug_r_a4, Bobby Holley, Mariusz Mlynski, Mario Heiderich, Frederic
    Buclin, Karthikeyan Bhargavan, and Matt McCutchen as the original
    reporters of these issues.
    
    Note: None of the issues in this advisory can be exploited by a
    specially crafted HTML mail message as JavaScript is disabled by
    default for mail messages. They could be exploited another way in
    Thunderbird, for example, when viewing the full remote content of an
    RSS feed.
    
    All Thunderbird users should upgrade to this updated package, which
    contains Thunderbird version 10.0.6 ESR, which corrects these issues.
    After installing the update, Thunderbird must be restarted for the
    changes to take effect."
      );
      # https://rhn.redhat.com/errata/RHBA-2012-0337.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHBA-2012:0337"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2012:1089"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1948"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1967"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1961"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1964"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1953"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1952"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1951"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1957"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1963"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1955"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1954"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1962"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1959"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1958"
      );
      script_set_attribute(
        attribute:"solution",
        value:
    "Update the affected thunderbird and / or thunderbird-debuginfo
    packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:thunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:thunderbird-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6.3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/07/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/07/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/07/18");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(5|6)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 5.x / 6.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2012:1089";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"thunderbird-10.0.6-1.el5_8", allowmaj:TRUE)) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"thunderbird-10.0.6-1.el5_8", allowmaj:TRUE)) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"thunderbird-debuginfo-10.0.6-1.el5_8", allowmaj:TRUE)) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"thunderbird-debuginfo-10.0.6-1.el5_8", allowmaj:TRUE)) flag++;
    
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"thunderbird-10.0.6-1.el6_3", allowmaj:TRUE)) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"thunderbird-10.0.6-1.el6_3", allowmaj:TRUE)) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"thunderbird-10.0.6-1.el6_3", allowmaj:TRUE)) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"thunderbird-debuginfo-10.0.6-1.el6_3", allowmaj:TRUE)) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"thunderbird-debuginfo-10.0.6-1.el6_3", allowmaj:TRUE)) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"thunderbird-debuginfo-10.0.6-1.el6_3", allowmaj:TRUE)) flag++;
    
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "thunderbird / thunderbird-debuginfo");
      }
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2514.NASL
    descriptionSeveral vulnerabilities have been discovered in Iceweasel, a web browser based on Firefox. The included XULRunner library provides rendering services for several other applications included in Debian. - CVE-2012-1948 Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill McCloskey identified several memory safety problems that may lead to the execution of arbitrary code. - CVE-2012-1950 Mario Gomes and Code Audit Labs discovered that it is possible to force Iceweasel to display the URL of the previous entered site through drag and drop actions to the address bar. This can be abused to perform phishing attacks. - CVE-2012-1954 Abhishek Arya discovered a use-after-free problem in nsDocument::AdoptNode that may lead to the execution of arbitrary code. - CVE-2012-1966
    last seen2020-03-17
    modified2012-07-18
    plugin id60005
    published2012-07-18
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60005
    titleDebian DSA-2514-1 : iceweasel - several vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-2514. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(60005);
      script_version("1.12");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2012-1948", "CVE-2012-1950", "CVE-2012-1954", "CVE-2012-1966", "CVE-2012-1967");
      script_xref(name:"DSA", value:"2514");
    
      script_name(english:"Debian DSA-2514-1 : iceweasel - several vulnerabilities");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities have been discovered in Iceweasel, a web
    browser based on Firefox. The included XULRunner library provides
    rendering services for several other applications included in Debian.
    
      - CVE-2012-1948
        Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill
        McCloskey identified several memory safety problems that
        may lead to the execution of arbitrary code.
    
      - CVE-2012-1950
        Mario Gomes and Code Audit Labs discovered that it is
        possible to force Iceweasel to display the URL of the
        previous entered site through drag and drop actions to
        the address bar. This can be abused to perform phishing
        attacks.
    
      - CVE-2012-1954
        Abhishek Arya discovered a use-after-free problem in
        nsDocument::AdoptNode that may lead to the execution of
        arbitrary code.
    
      - CVE-2012-1966
        'moz_bug_r_a4' discovered that it is possible to perform
        cross-site scripting attacks through the context menu
        when using data: URLs.
    
      - CVE-2012-1967
        'moz_bug_r_a4' discovered that in certain cases,
        javascript: URLs can be executed so that scripts can
        escape the JavaScript sandbox and run with elevated
        privileges.
    
    Note: We'd like to advise users of Iceweasel's 3.5 branch in Debian
    stable to consider to upgrade to the Iceweasel 10.0 ESR (Extended
    Support Release) which is now available in Debian Backports. Although
    Debian will continue to support Iceweasel 3.5 in stable with security
    updates, this can only be done on a best effort basis as upstream
    provides no such support anymore. On top of that, the 10.0 branch adds
    proactive security features to the browser."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2012-1948"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2012-1950"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2012-1954"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2012-1966"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2012-1967"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/squeeze/iceweasel"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2012/dsa-2514"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the iceweasel packages.
    
    For the stable distribution (squeeze), this problem has been fixed in
    version 3.5.16-17."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:iceweasel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/07/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/07/18");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"6.0", prefix:"iceweasel", reference:"3.5.16-17")) flag++;
    if (deb_check(release:"6.0", prefix:"iceweasel-dbg", reference:"3.5.16-17")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_140.NASL
    descriptionThe installed version of Firefox is earlier than 14.0 and thus, is potentially affected by the following security issues : - Several memory safety issues exist, some of which could potentially allow arbitrary code execution. (CVE-2012-1948, CVE-2012-1949) - An error related to drag and drop can allow incorrect URLs to be displayed. (CVE-2012-1950) - Several memory safety issues exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954) - An error related to JavaScript functions
    last seen2020-06-01
    modified2020-06-02
    plugin id60043
    published2012-07-19
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60043
    titleFirefox < 14.0 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(60043);
      script_version("1.14");
      script_cvs_date("Date: 2019/12/04");
    
      script_cve_id(
        "CVE-2012-1948",
        "CVE-2012-1949",
        "CVE-2012-1950",
        "CVE-2012-1951",
        "CVE-2012-1952",
        "CVE-2012-1953",
        "CVE-2012-1954",
        "CVE-2012-1955",
        "CVE-2012-1957",
        "CVE-2012-1958",
        "CVE-2012-1959",
        "CVE-2012-1960",
        "CVE-2012-1961",
        "CVE-2012-1962",
        "CVE-2012-1963",
        "CVE-2012-1965",
        "CVE-2012-1966",
        "CVE-2012-1967"
      );
      script_bugtraq_id(
        54572,
        54573,
        54574,
        54575,
        54576,
        54577,
        54578,
        54579,
        54580,
        54582,
        54583,
        54584,
        54585,
        54586
      );
    
      script_name(english:"Firefox < 14.0 Multiple Vulnerabilities");
      script_summary(english:"Checks version of Firefox");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a web browser that is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The installed version of Firefox is earlier than 14.0 and thus, is 
    potentially affected by the following security issues :
    
      - Several memory safety issues exist, some of which could
        potentially allow arbitrary code execution.
        (CVE-2012-1948, CVE-2012-1949)
    
      - An error related to drag and drop can allow incorrect
        URLs to be displayed. (CVE-2012-1950)
    
      - Several memory safety issues exist related to the Gecko
        layout engine. (CVE-2012-1951, CVE-2012-1952,
        CVE-2012-1953, CVE-2012-1954)
    
      - An error related to JavaScript functions
        'history.forward' and 'history.back' can allow
        incorrect URLs to be displayed. (CVE-2012-1955)
    
      - Cross-site scripting attacks are possible due to an
        error related to the '<embed>' tag within an RSS
        '<description>' element. (CVE-2012-1957)
    
      - A use-after-free error exists related to the method
        'nsGlobalWindow::PageHidden'. (CVE-2012-1958)
    
      - An error exists that can allow 'same-compartment
        security wrappers' (SCSW) to be bypassed.
        (CVE-2012-1959)
    
      - An out-of-bounds read error exists related to the color
        management library (QCMS). (CVE-2012-1960)
      
      - The 'X-Frames-Options' header is ignored if it is
        duplicated. (CVE-2012-1961)
    
      - A memory corruption error exists related to the method
        'JSDependentString::undepend'. (CVE-2012-1962)
    
      - An error related to the 'Content Security Policy' (CSP)
        implementation can allow the disclosure of OAuth 2.0
        access tokens and OpenID credentials. (CVE-2012-1963)
    
      - An error exists related to the 'feed:' URL that can
        allow cross-site scripting attacks. (CVE-2012-1965)
    
      - Cross-site scripting attacks are possible due to an
        error related to the 'data:' URL and context menus.
        (CVE-2012-1966)
    
      - An error exists related to the 'javascript:' URL that
        can allow scripts to run at elevated privileges outside
        the sandbox. (CVE-2012-1967)");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-42/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-43/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-44/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-45/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-46/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-47/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-48/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-49/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-50/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-51/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-52/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-53/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-55/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-56/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Firefox 14.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-1967");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/07/17");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/07/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/07/19");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("Mozilla/Firefox/Version");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    port = get_kb_item_or_exit("SMB/transport"); 
    
    installs = get_kb_list("SMB/Mozilla/Firefox/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "Firefox");
    
    mozilla_check_version(installs:installs, product:'firefox', esr:FALSE, fix:'14.0', severity:SECURITY_HOLE, xss:TRUE);
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_FIREFOX-201207-120719.NASL
    descriptionMozilla Firefox has been updated to the 10.0.6ESR security release fixing various bugs and several security issues, some critical. The following security issues have been fixed : - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2012-42) - Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill McCloskey reported memory safety problems and crashes that affect Firefox ESR 10 and Firefox 13. (CVE-2012-1948) - Security researcher Mario Gomes andresearch firm Code Audit Labs reported a mechanism to short-circuit page loads through drag and drop to the addressbar by canceling the page load. This causes the address of the previously site entered to be displayed in the addressbar instead of the currently loaded page. This could lead to potential phishing attacks on users. (MFSA 2012-43 / CVE-2012-1950) - Google security researcher Abhishek Arya used the Address Sanitizer tool to uncover four issues: two use-after-free problems, one out of bounds read bug, and a bad cast. The first use-afte.r-free problem is caused when an array of nsSMILTimeValueSpec objects is destroyed but attempts are made to call into objects in this array later. The second use-after-free problem is in nsDocument::AdoptNode when it adopts into an empty document and then adopts into another document, emptying the first one. The heap buffer overflow is in ElementAnimations when data is read off of end of an array and then pointers are dereferenced. The bad cast happens when nsTableFrame::InsertFrames is called with frames in aFrameList that are a mix of row group frames and column group frames. AppendFrames is not able to handle this mix. (MFSA 2012-44) All four of these issues are potentially exploitable. - Heap-use-after-free in nsSMILTimeValueSpec::IsEventBased. (CVE-2012-1951) - Heap-use-after-free in nsDocument::AdoptNode. (CVE-2012-1954) - Out of bounds read in ElementAnimations::EnsureStyleRuleFor. (CVE-2012-1953) - Bad cast in nsTableFrame::InsertFrames. (CVE-2012-1952) - Security researcher Mariusz Mlynski reported an issue with spoofing of the location property. In this issue, calls to history.forward and history.back are used to navigate to a site while displaying the previous site in the addressbar but changing the baseURI to the newer site. This can be used for phishing by allowing the user input form or other data on the newer, attacking, site while appearing to be on the older, displayed site. (MFSA 2012-45 / CVE-2012-1955) - Mozilla security researcher moz_bug_r_a4 reported a cross-site scripting (XSS) attack through the context menu using a data: URL. In this issue, context menu functionality (
    last seen2020-06-05
    modified2013-01-25
    plugin id64131
    published2013-01-25
    reporterThis script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/64131
    titleSuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 6574)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from SuSE 11 update information. The text itself is
    # copyright (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(64131);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-1948", "CVE-2012-1949", "CVE-2012-1950", "CVE-2012-1951", "CVE-2012-1952", "CVE-2012-1953", "CVE-2012-1954", "CVE-2012-1955", "CVE-2012-1957", "CVE-2012-1958", "CVE-2012-1959", "CVE-2012-1960", "CVE-2012-1961", "CVE-2012-1962", "CVE-2012-1963", "CVE-2012-1964", "CVE-2012-1965", "CVE-2012-1966", "CVE-2012-1967");
    
      script_name(english:"SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 6574)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 11 host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Mozilla Firefox has been updated to the 10.0.6ESR security release
    fixing various bugs and several security issues, some critical.
    
    The following security issues have been fixed :
    
      - Mozilla developers identified and fixed several memory
        safety bugs in the browser engine used in Firefox and
        other Mozilla-based products. Some of these bugs showed
        evidence of memory corruption under certain
        circumstances, and we presume that with enough effort at
        least some of these could be exploited to run arbitrary
        code. (MFSA 2012-42)
    
      - Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill
        McCloskey reported memory safety problems and crashes
        that affect Firefox ESR 10 and Firefox 13.
        (CVE-2012-1948)
    
      - Security researcher Mario Gomes andresearch firm Code
        Audit Labs reported a mechanism to short-circuit page
        loads through drag and drop to the addressbar by
        canceling the page load. This causes the address of the
        previously site entered to be displayed in the
        addressbar instead of the currently loaded page. This
        could lead to potential phishing attacks on users. (MFSA
        2012-43 / CVE-2012-1950)
    
      - Google security researcher Abhishek Arya used the
        Address Sanitizer tool to uncover four issues: two
        use-after-free problems, one out of bounds read bug, and
        a bad cast. The first use-afte.r-free problem is caused
        when an array of nsSMILTimeValueSpec objects is
        destroyed but attempts are made to call into objects in
        this array later. The second use-after-free problem is
        in nsDocument::AdoptNode when it adopts into an empty
        document and then adopts into another document, emptying
        the first one. The heap buffer overflow is in
        ElementAnimations when data is read off of end of an
        array and then pointers are dereferenced. The bad cast
        happens when nsTableFrame::InsertFrames is called with
        frames in aFrameList that are a mix of row group frames
        and column group frames. AppendFrames is not able to
        handle this mix. (MFSA 2012-44)
    
        All four of these issues are potentially exploitable.
    
      - Heap-use-after-free in
        nsSMILTimeValueSpec::IsEventBased. (CVE-2012-1951)
    
      - Heap-use-after-free in nsDocument::AdoptNode.
        (CVE-2012-1954)
    
      - Out of bounds read in
        ElementAnimations::EnsureStyleRuleFor. (CVE-2012-1953)
    
      - Bad cast in nsTableFrame::InsertFrames. (CVE-2012-1952)
    
      - Security researcher Mariusz Mlynski reported an issue
        with spoofing of the location property. In this issue,
        calls to history.forward and history.back are used to
        navigate to a site while displaying the previous site in
        the addressbar but changing the baseURI to the newer
        site. This can be used for phishing by allowing the user
        input form or other data on the newer, attacking, site
        while appearing to be on the older, displayed site.
        (MFSA 2012-45 / CVE-2012-1955)
    
      - Mozilla security researcher moz_bug_r_a4 reported a
        cross-site scripting (XSS) attack through the context
        menu using a data: URL. In this issue, context menu
        functionality ('View Image', 'Show only this frame', and
        'View background image') are disallowed in a javascript:
        URL but allowed in a data: URL, allowing for XSS. This
        can lead to arbitrary code execution. (MFSA 2012-46 /
        CVE-2012-1966)
    
      - Security researcher Mario Heiderich reported that
        JavaScript could be executed in the HTML feed-view using
        tag within the RSS . This problem is due to tags not
        being filtered out during parsing and can lead to a
        potential cross-site scripting (XSS) attack. The flaw
        existed in a parser utility class and could affect other
        parts of the browser or add-ons which rely on that class
        to sanitize untrusted input. (MFSA 2012-47 /
        CVE-2012-1957)
    
      - Security researcher Arthur Gerkis used the Address
        Sanitizer tool to find a use-after-free in
        nsGlobalWindow::PageHidden when mFocusedContent is
        released and oldFocusedContent is used afterwards. This
        use-after-free could possibly allow for remote code
        execution. (MFSA 2012-48 / CVE-2012-1958)
    
      - Mozilla developer Bobby Holley found that
        same-compartment security wrappers (SCSW) can be
        bypassed by passing them to another compartment.
        Cross-compartment wrappers often do not go through SCSW,
        but have a filtering policy built into them. When an
        object is wrapped cross-compartment, the SCSW is
        stripped off and, when the object is read read back, it
        is not known that SCSW was previously present, resulting
        in a bypassing of SCSW. This could result in untrusted
        content having access to the XBL that implements browser
        functionality. (MFSA 2012-49 / CVE-2012-1959)
    
      - Google developer Tony Payne reported an out of bounds
        (OOB) read in QCMS, Mozilla's color management library.
        With a carefully crafted color profile portions of a
        user's memory could be incorporated into a transformed
        image and possibly deciphered. (MFSA 2012-50 /
        CVE-2012-1960)
    
      - Bugzilla developer Frederic Buclin reported that the
        'X-Frame-Options header is ignored when the value is
        duplicated, for example X-Frame-Options: SAMEORIGIN,
        SAMEORIGIN. This duplication occurs for unknown reasons
        on some websites and when it occurs results in Mozilla
        browsers not being protected against possible
        clickjacking attacks on those pages. (MFSA 2012-51 /
        CVE-2012-1961)
    
      - Security researcher Bill Keese reported a memory
        corruption. This is caused by
        JSDependentString::undepend changing a dependent string
        into a fixed string when there are additional dependent
        strings relying on the same base. When the undepend
        occurs during conversion, the base data is freed,
        leaving other dependent strings with dangling pointers.
        This can lead to a potentially exploitable crash. (MFSA
        2012-52 / CVE-2012-1962)
    
      - Security researcher Karthikeyan Bhargavan of Prosecco at
        INRIA reported Content Security Policy (CSP) 1.0
        implementation errors. CSP violation reports generated
        by Firefox and sent to the 'report-uri' location include
        sensitive data within the 'blocked-uri' parameter. These
        include fragment components and query strings even if
        the 'blocked-uri' parameter has a different origin than
        the protected resource. This can be used to retrieve a
        user's OAuth 2.0 access tokens and OpenID credentials by
        malicious sites. (MFSA 2012-53 / CVE-2012-1963)
    
      - Security Researcher Matt McCutchen reported that a
        clickjacking attack using the certificate warning page.
        A man-in-the-middle (MITM) attacker can use an iframe to
        display its own certificate error warning page
        (about:certerror) with the 'Add Exception' button of a
        real warning page from a malicious site. This can
        mislead users to adding a certificate exception for a
        different site than the perceived one. This can lead to
        compromised communications with the user perceived site
        through the MITM attack once the certificate exception
        has been added. (MFSA 2012-54 / CVE-2012-1964)
    
      - Security researchers Mario Gomes and Soroush Dalili
        reported that since Mozilla allows the pseudo-protocol
        feed: to prefix any valid URL, it is possible to
        construct feed:javascript: URLs that will execute
        scripts in some contexts. On some sites it may be
        possible to use this to evade output filtering that
        would otherwise strip javascript: URLs and thus
        contribute to cross-site scripting (XSS) problems on
        these sites. (MFSA 2012-55 / CVE-2012-1965)
    
      - Mozilla security researcher moz_bug_r_a4 reported a
        arbitrary code execution attack using a javascript: URL.
        The Gecko engine features a JavaScript sandbox utility
        that allows the browser or add-ons to safely execute
        script in the context of a web page. In certain cases,
        javascript: URLs are executed in such a sandbox with
        insufficient context that can allow those scripts to
        escape from the sandbox and run with elevated privilege.
        This can lead to arbitrary code execution. (MFSA 2012-56
        / CVE-2012-1967)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-42.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-43.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-44.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-45.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-46.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-47.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-48.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-49.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-50.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-51.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-52.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-53.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-54.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-55.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.mozilla.org/security/announce/2012/mfsa2012-56.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=771583"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1948.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1949.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1950.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1951.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1952.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1953.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1954.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1955.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1957.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1958.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1959.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1960.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1961.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1962.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1963.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1964.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1965.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1966.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1967.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply SAT patch number 6574.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox-branding-SLED");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:MozillaFirefox-translations");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/07/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/25");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);
    
    pl = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(pl) || int(pl) != 1) audit(AUDIT_OS_NOT, "SuSE 11.1");
    
    
    flag = 0;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"MozillaFirefox-10.0.6-0.4.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"MozillaFirefox-branding-SLED-7-0.6.7.70")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"MozillaFirefox-translations-10.0.6-0.4.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"MozillaFirefox-10.0.6-0.4.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"MozillaFirefox-branding-SLED-7-0.6.7.70")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"MozillaFirefox-translations-10.0.6-0.4.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"MozillaFirefox-10.0.6-0.4.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"MozillaFirefox-branding-SLED-7-0.6.7.70")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"MozillaFirefox-translations-10.0.6-0.4.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_THUNDERBIRD_10_0_6.NASL
    descriptionThe installed version of Thunderbird 10.0.x is potentially affected by the following security issues : - Several memory safety issues exist, some of which could potentially allow arbitrary code execution. (CVE-2012-1948) - Several memory safety issues exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954) - An error related to JavaScript functions
    last seen2020-06-01
    modified2020-06-02
    plugin id60040
    published2012-07-19
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60040
    titleThunderbird 10.0.x < 10.0.6 Multiple Vulnerabilities (Mac OS X)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(60040);
      script_version("1.13");
      script_cvs_date("Date: 2019/12/04");
    
      script_cve_id(
        "CVE-2012-1948",
        "CVE-2012-1951",
        "CVE-2012-1952",
        "CVE-2012-1953",
        "CVE-2012-1954",
        "CVE-2012-1955",
        "CVE-2012-1957",
        "CVE-2012-1958",
        "CVE-2012-1959",
        "CVE-2012-1961",
        "CVE-2012-1962",
        "CVE-2012-1963",
        "CVE-2012-1964",
        "CVE-2012-1967"
      );
      script_bugtraq_id(
        54573,
        54574,
        54575,
        54576,
        54578,
        54581,
        54582,
        54583,
        54584,
        54586
      );
    
      script_name(english:"Thunderbird 10.0.x < 10.0.6 Multiple Vulnerabilities (Mac OS X)");
      script_summary(english:"Checks version of Thunderbird");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Mac OS X host contains a mail client that is potentially
    affected by several vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The installed version of Thunderbird 10.0.x is potentially affected 
    by the following security issues :
    
      - Several memory safety issues exist, some of which could
        potentially allow arbitrary code execution.
        (CVE-2012-1948)
    
      - Several memory safety issues exist related to the Gecko
        layout engine. (CVE-2012-1951, CVE-2012-1952,
        CVE-2012-1953, CVE-2012-1954)
    
      - An error related to JavaScript functions
        'history.forward' and 'history.back' can allow
        incorrect URLs to be displayed. (CVE-2012-1955)
    
      - Cross-site scripting attacks are possible due to an
        error related to the '<embed>' tag within an RSS
        '<description>' element. (CVE-2012-1957)
    
      - A use-after-free error exists related to the method
        'nsGlobalWindow::PageHidden'. (CVE-2012-1958)
    
      - An error exists that can allow 'same-compartment
        security wrappers' (SCSW) to be bypassed.
        (CVE-2012-1959)
    
      - The 'X-Frames-Options' header is ignored if it is
        duplicated. (CVE-2012-1961)
    
      - A memory corruption error exists related to the method
        'JSDependentString::undepend'. (CVE-2012-1962)
    
      - An error related to the 'Content Security Policy' (CSP)
        implementation can allow the disclosure of OAuth 2.0
        access tokens and OpenID credentials. (CVE-2012-1963)
    
      - An error exists related to the certificate warning page
        that can allow 'clickjacking' thereby tricking a user
        into accepting unintended certificates. (CVE-2012-1964)
    
      - An error exists related to the 'javascript:' URL that
        can allow scripts to run at elevated privileges outside
        the sandbox. (CVE-2012-1967)");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-42/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-44/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-45/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-47/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-48/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-49/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-51/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-52/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-53/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-54/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-56/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Thunderbird 10.0.6 ESR or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-1967");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/07/17");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/07/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/07/19");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:thunderbird");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("macosx_thunderbird_installed.nasl");
      script_require_keys("MacOSX/Thunderbird/Installed");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    kb_base = "MacOSX/Thunderbird";
    get_kb_item_or_exit(kb_base+"/Installed");
    
    version = get_kb_item_or_exit(kb_base+"/Version", exit_code:1);
    path = get_kb_item_or_exit(kb_base+"/Path", exit_code:1);
    
    mozilla_check_version(product:'thunderbird', version:version, path:path, fix:'10.0.6', min:'10.0', severity:SECURITY_HOLE, xss:TRUE);
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_1006.NASL
    descriptionThe installed version of Firefox 10.0.x is potentially affected by the following security issues : - Several memory safety issues exist, some of which could potentially allow arbitrary code execution. (CVE-2012-1948) - An error related to drag and drop can allow incorrect URLs to be displayed. (CVE-2012-1950) - Several memory safety issues exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954) - An error related to JavaScript functions
    last seen2020-06-01
    modified2020-06-02
    plugin id60042
    published2012-07-19
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60042
    titleFirefox 10.0.x < 10.0.6 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(60042);
      script_version("1.13");
      script_cvs_date("Date: 2019/12/04");
    
      script_cve_id(
        "CVE-2012-1948",
        "CVE-2012-1950",
        "CVE-2012-1951",
        "CVE-2012-1952",
        "CVE-2012-1953",
        "CVE-2012-1954",
        "CVE-2012-1955",
        "CVE-2012-1957",
        "CVE-2012-1958",
        "CVE-2012-1959",
        "CVE-2012-1961",
        "CVE-2012-1962",
        "CVE-2012-1963",
        "CVE-2012-1964",
        "CVE-2012-1965",
        "CVE-2012-1966",
        "CVE-2012-1967"
      );
      script_bugtraq_id(
        54573,
        54574,
        54575,
        54576,
        54577,
        54578,
        54579,
        54581,
        54582,
        54583,
        54584,
        54585,
        54586
      );
    
      script_name(english:"Firefox 10.0.x < 10.0.6 Multiple Vulnerabilities");
      script_summary(english:"Checks version of Firefox");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a web browser that is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The installed version of Firefox 10.0.x is potentially
    affected by the following security issues :
    
      - Several memory safety issues exist, some of which could
        potentially allow arbitrary code execution.
        (CVE-2012-1948)
    
      - An error related to drag and drop can allow incorrect
        URLs to be displayed. (CVE-2012-1950)
    
      - Several memory safety issues exist related to the Gecko
        layout engine. (CVE-2012-1951, CVE-2012-1952,
        CVE-2012-1953, CVE-2012-1954)
    
      - An error related to JavaScript functions
        'history.forward' and 'history.back' can allow
        incorrect URLs to be displayed. (CVE-2012-1955)
    
      - Cross-site scripting attacks are possible due to an
        error related to the '<embed>' tag within an RSS
        '<description>' element. (CVE-2012-1957)
    
      - A use-after-free error exists related to the method
        'nsGlobalWindow::PageHidden'. (CVE-2012-1958)
    
      - An error exists that can allow 'same-compartment
        security wrappers' (SCSW) to be bypassed.
        (CVE-2012-1959)
      
      - The 'X-Frames-Options' header is ignored if it is
        duplicated. (CVE-2012-1961)
    
      - A memory corruption error exists related to the method
        'JSDependentString::undepend'. (CVE-2012-1962)
    
      - An error related to the 'Content Security Policy' (CSP)
        implementation can allow the disclosure of OAuth 2.0
        access tokens and OpenID credentials. (CVE-2012-1963)
    
      - An error exists related to the certificate warning page
        that can allow 'clickjacking' thereby tricking a user
        into accepting unintended certificates. (CVE-2012-1964)
    
      - An error exists related to the 'feed:' URL that can
        allow cross-site scripting attacks. (CVE-2012-1965)
    
      - Cross-site scripting attacks are possible due to an
        error related to the 'data:' URL and context menus.
        (CVE-2012-1966)
    
      - An error exists related to the 'javascript:' URL that
        can allow scripts to run at elevated privileges outside
        the sandbox. (CVE-2012-1967)");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-42/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-43/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-44/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-45/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-46/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-47/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-48/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-49/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-51/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-52/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-53/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-54/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-55/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2012-56/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Firefox 10.0.6 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-1967");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/07/17");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/07/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/07/19");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("Mozilla/Firefox/Version");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    port = get_kb_item_or_exit("SMB/transport"); 
    
    installs = get_kb_list("SMB/Mozilla/Firefox/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "Firefox");
    
    mozilla_check_version(installs:installs, product:'firefox', esr:TRUE, fix:'10.0.6', min:'10.0', severity:SECURITY_HOLE, xss:TRUE);
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2012-1089.NASL
    descriptionAn updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962, CVE-2012-1967) Malicious content could bypass same-compartment security wrappers (SCSW) and execute arbitrary code with chrome privileges. (CVE-2012-1959) A flaw in the way Thunderbird called history.forward and history.back could allow an attacker to conceal a malicious URL, possibly tricking a user into believing they are viewing trusted content. (CVE-2012-1955) A flaw in a parser utility class used by Thunderbird to parse feeds (such as RSS) could allow an attacker to execute arbitrary JavaScript with the privileges of the user running Thunderbird. This issue could have affected other Thunderbird components or add-ons that assume the class returns sanitized input. (CVE-2012-1957) A flaw in the way Thunderbird handled X-Frame-Options headers could allow malicious content to perform a clickjacking attack. (CVE-2012-1961) A flaw in the way Content Security Policy (CSP) reports were generated by Thunderbird could allow malicious content to steal a victim
    last seen2020-05-31
    modified2012-07-18
    plugin id59999
    published2012-07-18
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59999
    titleCentOS 5 / 6 : thunderbird (CESA-2012:1089)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_14_0.NASL
    descriptionThe installed version of Firefox is earlier than 14.0 and thus, is potentially affected by the following security issues : - Several memory safety issues exist, some of which could potentially allow arbitrary code execution. (CVE-2012-1948, CVE-2012-1949) - An error related to drag and drop can allow incorrect URLs to be displayed. (CVE-2012-1950) - Several memory safety issues exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954) - An error related to JavaScript functions
    last seen2020-06-01
    modified2020-06-02
    plugin id60039
    published2012-07-19
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60039
    titleFirefox < 14.0 Multiple Vulnerabilities (Mac OS X)
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS11_THUNDERBIRD_20130129.NASL
    descriptionThe remote Solaris system is missing necessary patches to address security updates : - Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2012-1948) - The drag-and-drop implementation in Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 allows remote attackers to spoof the address bar by canceling a page load. (CVE-2012-1950) - Use-after-free vulnerability in the nsSMILTimeValueSpec::IsEventBased function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code by interacting with objects used for SMIL Timing. (CVE-2012-1951) - The nsTableFrame::InsertFrames function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly perform a cast of a frame variable during processing of mixed row-group and column-group frames, which might allow remote attackers to execute arbitrary code via a crafted web site. (CVE-2012-1952) - The ElementAnimations::EnsureStyleRuleFor function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (buffer over-read, incorrect pointer dereference, and heap-based buffer overflow) or possibly execute arbitrary code via a crafted web site. (CVE-2012-1953) - Use-after-free vulnerability in the nsDocument::AdoptNode function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via vectors involving multiple adoptions and empty documents. (CVE-2012-1954) - Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allow remote attackers to spoof the address bar via vectors involving history.forward and history.back calls. (CVE-2012-1955) - An unspecified parser-utility class in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly handle EMBED elements within description elements in RSS feeds, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a feed. (CVE-2012-1957) - Use-after-free vulnerability in the nsGlobalWindow::PageHidden function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 might allow remote attackers to execute arbitrary code via vectors related to focused content. (CVE-2012-1958) - Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not consider the presence of same-compartment security wrappers (SCSW) during the cross-compartment wrapping of objects, which allows remote attackers to bypass intended XBL access restrictions via crafted content. (CVE-2012-1959) - Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly handle duplicate values in X-Frame-Options headers, which makes it easier for remote attackers to conduct clickjacking attacks via a FRAME element referencing a web site that produces these duplicate values. (CVE-2012-1961) - Use-after-free vulnerability in the JSDependentString::undepend function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via vectors involving strings with multiple dependencies. (CVE-2012-1962) - The Content Security Policy (CSP) functionality in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly restrict the strings placed into the blocked-uri parameter of a violation report, which allows remote web servers to capture OpenID credentials and OAuth 2.0 access tokens by triggering a violation. (CVE-2012-1963) - The certificate-warning functionality in browser/components/certerror/content/ aboutCertError.xhtml in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.10 does not properly handle attempted clickjacking of the about:certerror page, which allows man-in-the-middle attackers to trick users into adding an unintended exception via an IFRAME element. (CVE-2012-1964) - Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not properly establish the security context of a feed: URL, which allows remote attackers to bypass unspecified cross-site scripting (XSS) protection mechanisms via a feed:javascript: URL. (CVE-2012-1965) - Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not have the same context-menu restrictions for data: URLs as for javascript: URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL. (CVE-2012-1966) - Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL. (CVE-2012-1967) - Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2012-1970) - Use-after-free vulnerability in the nsObjectLoadingContent::LoadObject function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. (CVE-2012-1973) - Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a negative height value in a BMP image within a .ICO file, related to (1) improper handling of the transparency bitmask by the nsICODecoder component and (2) improper processing of the alpha channel by the nsBMPDecoder component. (CVE-2012-3966)
    last seen2020-06-01
    modified2020-06-02
    plugin id80787
    published2015-01-19
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/80787
    titleOracle Solaris Third-Party Patch Update : thunderbird (multiple_vulnerabilities_in_thunderbird7)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_DBF338D0DCE511E1B65514DAE9EBCF89.NASL
    descriptionThe Mozilla Project reports : MFSA 2012-42 Miscellaneous memory safety hazards (rv:14.0/ rv:10.0.6) MFSA 2012-43 Incorrect URL displayed in addressbar through drag and drop MFSA 2012-44 Gecko memory corruption MFSA 2012-45 Spoofing issue with location MFSA 2012-46 XSS through data: URLs MFSA 2012-47 Improper filtering of JavaScript in HTML feed-view MFSA 2012-48 use-after-free in nsGlobalWindow::PageHidden MFSA 2012-49 Same-compartment Security Wrappers can be bypassed MFSA 2012-50 Out of bounds read in QCMS MFSA 2012-51 X-Frame-Options header ignored when duplicated MFSA 2012-52 JSDependentString::undepend string conversion results in memory corruption MFSA 2012-53 Content Security Policy 1.0 implementation errors cause data leakage MFSA 2012-54 Clickjacking of certificate warning page MFSA 2012-55 feed: URLs with an innerURI inherit security context of page MFSA 2012-56 Code execution through javascript: URLs
    last seen2020-06-01
    modified2020-06-02
    plugin id61402
    published2012-08-03
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61402
    titleFreeBSD : mozilla -- multiple vulnerabilities (dbf338d0-dce5-11e1-b655-14dae9ebcf89)
  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_1006.NASL
    descriptionThe installed version of Thunderbird 10.0.x is potentially affected by the following security issues : - Several memory safety issues exist, some of which could potentially allow arbitrary code execution. (CVE-2012-1948) - Several memory safety issues exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954) - An error related to JavaScript functions
    last seen2020-06-01
    modified2020-06-02
    plugin id60044
    published2012-07-19
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60044
    titleMozilla Thunderbird 10.0.x < 10.0.6 Multiple Vulnerabilities
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2012-110.NASL
    descriptionSecurity issues were identified and fixed in mozilla firefox and thunderbird : Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code (CVE-2012-1949, CVE-2012-1948). Security researcher Mario Gomes andresearch firm Code Audit Labs reported a mechanism to short-circuit page loads through drag and drop to the addressbar by canceling the page load. This causes the address of the previously site entered to be displayed in the addressbar instead of the currently loaded page. This could lead to potential phishing attacks on users (CVE-2012-1950). Google security researcher Abhishek Arya used the Address Sanitizer tool to uncover four issues: two use-after-free problems, one out of bounds read bug, and a bad cast. The first use-after-free problem is caused when an array of nsSMILTimeValueSpec objects is destroyed but attempts are made to call into objects in this array later. The second use-after-free problem is in nsDocument::AdoptNode when it adopts into an empty document and then adopts into another document, emptying the first one. The heap buffer overflow is in ElementAnimations when data is read off of end of an array and then pointers are dereferenced. The bad cast happens when nsTableFrame::InsertFrames is called with frames in aFrameList that are a mix of row group frames and column group frames. AppendFrames is not able to handle this mix. All four of these issues are potentially exploitable (CVE-2012-1951, CVE-2012-1954, CVE-2012-1953, CVE-2012-1952). Security researcher Mariusz Mlynski reported an issue with spoofing of the location property. In this issue, calls to history.forward and history.back are used to navigate to a site while displaying the previous site in the addressbar but changing the baseURI to the newer site. This can be used for phishing by allowing the user input form or other data on the newer, attacking, site while appearing to be on the older, displayed site (CVE-2012-1955). Mozilla security researcher moz_bug_r_a4 reported a cross-site scripting (XSS) attack through the context menu using a data: URL. In this issue, context menu functionality (View Image, Show only this frame, and View background image) are disallowed in a javascript: URL but allowed in a data: URL, allowing for XSS. This can lead to arbitrary code execution (CVE-2012-1966). Security researcher Mario Heiderich reported that JavaScript could be executed in the HTML feed-view using <embed> tag within the RSS <description>. This problem is due to <embed> tags not being filtered out during parsing and can lead to a potential cross-site scripting (XSS) attack. The flaw existed in a parser utility class and could affect other parts of the browser or add-ons which rely on that class to sanitize untrusted input (CVE-2012-1957). Security researcher Arthur Gerkis used the Address Sanitizer tool to find a use-after-free in nsGlobalWindow::PageHidden when mFocusedContent is released and oldFocusedContent is used afterwards. This use-after-free could possibly allow for remote code execution (CVE-2012-1958). Mozilla developer Bobby Holley found that same-compartment security wrappers (SCSW) can be bypassed by passing them to another compartment. Cross-compartment wrappers often do not go through SCSW, but have a filtering policy built into them. When an object is wrapped cross-compartment, the SCSW is stripped off and, when the object is read read back, it is not known that SCSW was previously present, resulting in a bypassing of SCSW. This could result in untrusted content having access to the XBL that implements browser functionality (CVE-2012-1959). Google developer Tony Payne reported an out of bounds (OOB) read in QCMS, Mozillas color management library. With a carefully crafted color profile portions of a user
    last seen2020-06-01
    modified2020-06-02
    plugin id61963
    published2012-09-06
    reporterThis script is Copyright (C) 2012-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/61963
    titleMandriva Linux Security Advisory : mozilla (MDVSA-2012:110-1)
  • NASL familyWindows
    NASL idSEAMONKEY_211.NASL
    descriptionThe installed version of SeaMonkey is earlier than 2.11.0. Such versions are potentially affected by the following security issues : - Several memory safety issues exist, some of which could potentially allow arbitrary code execution. (CVE-2012-1948, CVE-2012-1949) - Several memory safety issues exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954) - An error related to JavaScript functions
    last seen2020-06-01
    modified2020-06-02
    plugin id60046
    published2012-07-19
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60046
    titleSeaMonkey < 2.11.0 Multiple Vulnerabilities
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2528.NASL
    descriptionSeveral vulnerabilities were discovered in Icedove, Debian
    last seen2020-03-17
    modified2012-08-15
    plugin id61537
    published2012-08-15
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61537
    titleDebian DSA-2528-1 : icedove - several vulnerabilities
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2012-1088.NASL
    descriptionUpdated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962, CVE-2012-1967) A malicious web page could bypass same-compartment security wrappers (SCSW) and execute arbitrary code with chrome privileges. (CVE-2012-1959) A flaw in the context menu functionality in Firefox could allow a malicious website to bypass intended restrictions and allow a cross-site scripting attack. (CVE-2012-1966) A page different to that in the address bar could be displayed when dragging and dropping to the address bar, possibly making it easier for a malicious site or user to perform a phishing attack. (CVE-2012-1950) A flaw in the way Firefox called history.forward and history.back could allow an attacker to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site. (CVE-2012-1955) A flaw in a parser utility class used by Firefox to parse feeds (such as RSS) could allow an attacker to execute arbitrary JavaScript with the privileges of the user running Firefox. This issue could have affected other browser components or add-ons that assume the class returns sanitized input. (CVE-2012-1957) A flaw in the way Firefox handled X-Frame-Options headers could allow a malicious website to perform a clickjacking attack. (CVE-2012-1961) A flaw in the way Content Security Policy (CSP) reports were generated by Firefox could allow a malicious web page to steal a victim
    last seen2020-05-31
    modified2012-07-18
    plugin id60008
    published2012-07-18
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60008
    titleRHEL 5 / 6 : firefox (RHSA-2012:1088)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2012-1088.NASL
    descriptionUpdated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962, CVE-2012-1967) A malicious web page could bypass same-compartment security wrappers (SCSW) and execute arbitrary code with chrome privileges. (CVE-2012-1959) A flaw in the context menu functionality in Firefox could allow a malicious website to bypass intended restrictions and allow a cross-site scripting attack. (CVE-2012-1966) A page different to that in the address bar could be displayed when dragging and dropping to the address bar, possibly making it easier for a malicious site or user to perform a phishing attack. (CVE-2012-1950) A flaw in the way Firefox called history.forward and history.back could allow an attacker to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site. (CVE-2012-1955) A flaw in a parser utility class used by Firefox to parse feeds (such as RSS) could allow an attacker to execute arbitrary JavaScript with the privileges of the user running Firefox. This issue could have affected other browser components or add-ons that assume the class returns sanitized input. (CVE-2012-1957) A flaw in the way Firefox handled X-Frame-Options headers could allow a malicious website to perform a clickjacking attack. (CVE-2012-1961) A flaw in the way Content Security Policy (CSP) reports were generated by Firefox could allow a malicious web page to steal a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id59998
    published2012-07-18
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59998
    titleCentOS 5 / 6 : firefox (CESA-2012:1088)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2513.NASL
    descriptionSeveral vulnerabilities have been found in the Iceape internet suite, an unbranded version of SeaMonkey : - CVE-2012-1948 Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill McCloskey identified several memory safety problems that may lead to the execution of arbitrary code. - CVE-2012-1954 Abhishek Arya discovered a use-after-free problem in nsDocument::AdoptNode that may lead to the execution of arbitrary code. - CVE-2012-1967
    last seen2020-03-17
    modified2012-07-18
    plugin id60004
    published2012-07-18
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60004
    titleDebian DSA-2513-1 : iceape - several vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-443.NASL
    descriptionMozilla Thunderbird was updated to version 14.0 (bnc#771583) - MFSA 2012-42/CVE-2012-1949/CVE-2012-1948 Miscellaneous memory safety hazards - MFSA 2012-44/CVE-2012-1951/CVE-2012-1954/CVE-2012-1953/CVE-20 12-1952 Gecko memory corruption - MFSA 2012-45/CVE-2012-1955 (bmo#757376) Spoofing issue with location - MFSA 2012-47/CVE-2012-1957 (bmo#750096) Improper filtering of JavaScript in HTML feed-view - MFSA 2012-48/CVE-2012-1958 (bmo#750820) use-after-free in nsGlobalWindow::PageHidden - MFSA 2012-49/CVE-2012-1959 (bmo#754044, bmo#737559) Same-compartment Security Wrappers can be bypassed - MFSA 2012-50/CVE-2012-1960 (bmo#761014) Out of bounds read in QCMS - MFSA 2012-51/CVE-2012-1961 (bmo#761655) X-Frame-Options header ignored when duplicated - MFSA 2012-52/CVE-2012-1962 (bmo#764296) JSDependentString::undepend string conversion results in memory corruption - MFSA 2012-53/CVE-2012-1963 (bmo#767778) Content Security Policy 1.0 implementation errors cause data leakage - MFSA 2012-56/CVE-2012-1967 (bmo#758344) Code execution through javascript: URLs - relicensed to MPL-2.0 - update Enigmail to 1.4.3 - no crashreport on %arm, fixing build
    last seen2020-06-05
    modified2014-06-13
    plugin id74691
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74691
    titleopenSUSE Security Update : MozillaThunderbird (openSUSE-SU-2012:0917-1)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1510-1.NASL
    descriptionBenoit Jacob, Jesse Ruderman, Christian Holler, Bill McCloskey, Brian Smith, Gary Kwong, Christoph Diehl, Chris Jones, Brad Lassey, and Kyle Huey discovered memory safety issues affecting Thunderbird. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2012-1948, CVE-2012-1949) Abhishek Arya discovered four memory safety issues affecting Thunderbird. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954) Mariusz Mlynski discovered that the address bar may be incorrectly updated. Calls to history.forward and history.back could be used to navigate to a site while the address bar still displayed the previous site. A remote attacker could exploit this to conduct phishing attacks. (CVE-2012-1955) Mario Heiderich discovered that HTML <embed> tags were not filtered out of the HTML <description> of RSS feeds. A remote attacker could exploit this to conduct cross-site scripting (XSS) attacks via JavaScript execution in the HTML feed view. (CVE-2012-1957) Arthur Gerkis discovered a use-after-free vulnerability. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Thunderbird. (CVE-2012-1958) Bobby Holley discovered that same-compartment security wrappers (SCSW) could be bypassed to allow XBL access. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to execute code with the privileges of the user invoking Thunderbird. (CVE-2012-1959) Tony Payne discovered an out-of-bounds memory read in Mozilla
    last seen2020-06-01
    modified2020-06-02
    plugin id60014
    published2012-07-18
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60014
    titleUbuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : thunderbird vulnerabilities (USN-1510-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-410.NASL
    descriptionMozillaFirefox was updated to 14.0.1 to fix various bugs and security issues. Following security issues were fixed: MFSA 2012-42: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. CVE-2012-1949: Brian Smith, Gary Kwong, Christian Holler, Jesse Ruderman, Christoph Diehl, Chris Jones, Brad Lassey, and Kyle Huey reported memory safety problems and crashes that affect Firefox 13. CVE-2012-1948: Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill McCloskey reported memory safety problems and crashes that affect Firefox ESR 10 and Firefox 13. MFSA 2012-43 / CVE-2012-1950: Security researcher Mario Gomes andresearch firm Code Audit Labs reported a mechanism to short-circuit page loads through drag and drop to the addressbar by canceling the page load. This causes the address of the previously site entered to be displayed in the addressbar instead of the currently loaded page. This could lead to potential phishing attacks on users. MFSA 2012-44 Google security researcher Abhishek Arya used the Address Sanitizer tool to uncover four issues: two use-after-free problems, one out of bounds read bug, and a bad cast. The first use-after-free problem is caused when an array of nsSMILTimeValueSpec objects is destroyed but attempts are made to call into objects in this array later. The second use-after-free problem is in nsDocument::AdoptNode when it adopts into an empty document and then adopts into another document, emptying the first one. The heap buffer overflow is in ElementAnimations when data is read off of end of an array and then pointers are dereferenced. The bad cast happens when nsTableFrame::InsertFrames is called with frames in aFrameList that are a mix of row group frames and column group frames. AppendFrames is not able to handle this mix. All four of these issues are potentially exploitable. CVE-2012-1951: Heap-use-after-free in nsSMILTimeValueSpec::IsEventBased CVE-2012-1954: Heap-use-after-free in nsDocument::AdoptNode CVE-2012-1953: Out of bounds read in ElementAnimations::EnsureStyleRuleFor CVE-2012-1952: Bad cast in nsTableFrame::InsertFrames MFSA 2012-45 / CVE-2012-1955: Security researcher Mariusz Mlynski reported an issue with spoofing of the location property. In this issue, calls to history.forward and history.back are used to navigate to a site while displaying the previous site in the addressbar but changing the baseURI to the newer site. This can be used for phishing by allowing the user input form or other data on the newer, attacking, site while appearing to be on the older, displayed site. MFSA 2012-46 / CVE-2012-1966: Mozilla security researcher moz_bug_r_a4 reported a cross-site scripting (XSS) attack through the context menu using a data: URL. In this issue, context menu functionality (
    last seen2020-06-05
    modified2014-06-13
    plugin id74687
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74687
    titleopenSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:0899-1)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_THUNDERBIRD_14_0.NASL
    descriptionThe installed version of Thunderbird is earlier than 14.0 and thus, is potentially affected by the following security issues : - Several memory safety issues exist, some of which could potentially allow arbitrary code execution. (CVE-2012-1948, CVE-2012-1949) - Several memory safety issues exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954) - An error related to JavaScript functions
    last seen2020-06-01
    modified2020-06-02
    plugin id60041
    published2012-07-19
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60041
    titleThunderbird < 14.0 Multiple Vulnerabilities (Mac OS X)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1509-1.NASL
    descriptionBenoit Jacob, Jesse Ruderman, Christian Holler, Bill McCloskey, Brian Smith, Gary Kwong, Christoph Diehl, Chris Jones, Brad Lassey, and Kyle Huey discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1948, CVE-2012-1949) Mario Gomes discovered that the address bar may be incorrectly updated. Drag-and-drop events in the address bar may cause the address of the previous site to be displayed while a new page is loaded. An attacker could exploit this to conduct phishing attacks. (CVE-2012-1950) Abhishek Arya discovered four memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954) Mariusz Mlynski discovered that the address bar may be incorrectly updated. Calls to history.forward and history.back could be used to navigate to a site while the address bar still displayed the previous site. A remote attacker could exploit this to conduct phishing attacks. (CVE-2012-1955) Mario Heiderich discovered that HTML <embed> tags were not filtered out of the HTML <description> of RSS feeds. A remote attacker could exploit this to conduct cross-site scripting (XSS) attacks via JavaScript execution in the HTML feed view. (CVE-2012-1957) Arthur Gerkis discovered a use-after-free vulnerability. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1958) Bobby Holley discovered that same-compartment security wrappers (SCSW) could be bypassed to allow XBL access. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to execute code with the privileges of the user invoking Firefox. (CVE-2012-1959) Tony Payne discovered an out-of-bounds memory read in Mozilla
    last seen2020-06-01
    modified2020-06-02
    plugin id60012
    published2012-07-18
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60012
    titleUbuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : firefox vulnerabilities (USN-1509-1)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_10_0_6.NASL
    descriptionThe installed version of Firefox is earlier than 10.0.6 and thus, is potentially affected by the following security issues : - Several memory safety issues exist, some of which could potentially allow arbitrary code execution. (CVE-2012-1948) - An error related to drag and drop can allow incorrect URLs to be displayed. (CVE-2012-1950) - Several memory safety issues exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954) - An error related to JavaScript functions
    last seen2020-06-01
    modified2020-06-02
    plugin id60038
    published2012-07-19
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60038
    titleFirefox < 10.0.6 Multiple Vulnerabilities (Mac OS X)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201301-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, bypass restrictions and protection mechanisms, force file downloads, conduct XML injection attacks, conduct XSS attacks, bypass the Same Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical scroll, spoof the location bar, spoof an SSL indicator, modify the browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified impact. A local attacker could gain escalated privileges, obtain sensitive information, or replace an arbitrary downloaded file. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id63402
    published2013-01-08
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63402
    titleGLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)
  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_140.NASL
    descriptionThe installed version of Thunderbird is earlier than 14.0 and thus, is potentially affected by the following security issues : - Several memory safety issues exist, some of which could potentially allow arbitrary code execution. (CVE-2012-1948, CVE-2012-1949) - Several memory safety issues exist related to the Gecko layout engine. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954) - An error related to JavaScript functions
    last seen2020-06-01
    modified2020-06-02
    plugin id60045
    published2012-07-19
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60045
    titleMozilla Thunderbird < 14.0 Multiple Vulnerabilities
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20120717_FIREFOX_ON_SL5_X.NASL
    descriptionMozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2012-1948, CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954, CVE-2012-1958, CVE-2012-1962, CVE-2012-1967) A malicious web page could bypass same-compartment security wrappers (SCSW) and execute arbitrary code with chrome privileges. (CVE-2012-1959) A flaw in the context menu functionality in Firefox could allow a malicious website to bypass intended restrictions and allow a cross-site scripting attack. (CVE-2012-1966) A page different to that in the address bar could be displayed when dragging and dropping to the address bar, possibly making it easier for a malicious site or user to perform a phishing attack. (CVE-2012-1950) A flaw in the way Firefox called history.forward and history.back could allow an attacker to conceal a malicious URL, possibly tricking a user into believing they are viewing a trusted site. (CVE-2012-1955) A flaw in a parser utility class used by Firefox to parse feeds (such as RSS) could allow an attacker to execute arbitrary JavaScript with the privileges of the user running Firefox. This issue could have affected other browser components or add-ons that assume the class returns sanitized input. (CVE-2012-1957) A flaw in the way Firefox handled X-Frame-Options headers could allow a malicious website to perform a clickjacking attack. (CVE-2012-1961) A flaw in the way Content Security Policy (CSP) reports were generated by Firefox could allow a malicious web page to steal a victim
    last seen2020-03-18
    modified2012-08-01
    plugin id61364
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61364
    titleScientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20120717)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1509-2.NASL
    descriptionUSN-1509-1 fixed vulnerabilities in Firefox. This update provides an updated ubufox package for use with the lastest Firefox. Benoit Jacob, Jesse Ruderman, Christian Holler, Bill McCloskey, Brian Smith, Gary Kwong, Christoph Diehl, Chris Jones, Brad Lassey, and Kyle Huey discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1948, CVE-2012-1949) Mario Gomes discovered that the address bar may be incorrectly updated. Drag-and-drop events in the address bar may cause the address of the previous site to be displayed while a new page is loaded. An attacker could exploit this to conduct phishing attacks. (CVE-2012-1950) Abhishek Arya discovered four memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1951, CVE-2012-1952, CVE-2012-1953, CVE-2012-1954) Mariusz Mlynski discovered that the address bar may be incorrectly updated. Calls to history.forward and history.back could be used to navigate to a site while the address bar still displayed the previous site. A remote attacker could exploit this to conduct phishing attacks. (CVE-2012-1955) Mario Heiderich discovered that HTML <embed> tags were not filtered out of the HTML <description> of RSS feeds. A remote attacker could exploit this to conduct cross-site scripting (XSS) attacks via JavaScript execution in the HTML feed view. (CVE-2012-1957) Arthur Gerkis discovered a use-after-free vulnerability. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. (CVE-2012-1958) Bobby Holley discovered that same-compartment security wrappers (SCSW) could be bypassed to allow XBL access. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit this to execute code with the privileges of the user invoking Firefox. (CVE-2012-1959) Tony Payne discovered an out-of-bounds memory read in Mozilla
    last seen2020-06-01
    modified2020-06-02
    plugin id60013
    published2012-07-18
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60013
    titleUbuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : ubufox update (USN-1509-2)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-465.NASL
    descriptionMozilla XULRunner was updated to 14.0.1, fixing bugs and security issues : Following security issues were fixed: MFSA 2012-42: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. CVE-2012-1949: Brian Smith, Gary Kwong, Christian Holler, Jesse Ruderman, Christoph Diehl, Chris Jones, Brad Lassey, and Kyle Huey reported memory safety problems and crashes that affect Firefox 13. CVE-2012-1948: Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill McCloskey reported memory safety problems and crashes that affect Firefox ESR 10 and Firefox 13. MFSA 2012-43 / CVE-2012-1950: Security researcher Mario Gomes andresearch firm Code Audit Labs reported a mechanism to short-circuit page loads through drag and drop to the addressbar by canceling the page load. This causes the address of the previously site entered to be displayed in the addressbar instead of the currently loaded page. This could lead to potential phishing attacks on users. MFSA 2012-44 Google security researcher Abhishek Arya used the Address Sanitizer tool to uncover four issues: two use-after-free problems, one out of bounds read bug, and a bad cast. The first use-after-free problem is caused when an array of nsSMILTimeValueSpec objects is destroyed but attempts are made to call into objects in this array later. The second use-after-free problem is in nsDocument::AdoptNode when it adopts into an empty document and then adopts into another document, emptying the first one. The heap buffer overflow is in ElementAnimations when data is read off of end of an array and then pointers are dereferenced. The bad cast happens when nsTableFrame::InsertFrames is called with frames in aFrameList that are a mix of row group frames and column group frames. AppendFrames is not able to handle this mix. All four of these issues are potentially exploitable. CVE-2012-1951: Heap-use-after-free in nsSMILTimeValueSpec::IsEventBased CVE-2012-1954: Heap-use-after-free in nsDocument::AdoptNode CVE-2012-1953: Out of bounds read in ElementAnimations::EnsureStyleRuleFor CVE-2012-1952: Bad cast in nsTableFrame::InsertFrames MFSA 2012-45 / CVE-2012-1955: Security researcher Mariusz Mlynski reported an issue with spoofing of the location property. In this issue, calls to history.forward and history.back are used to navigate to a site while displaying the previous site in the addressbar but changing the baseURI to the newer site. This can be used for phishing by allowing the user input form or other data on the newer, attacking, site while appearing to be on the older, displayed site. MFSA 2012-46 / CVE-2012-1966: Mozilla security researcher moz_bug_r_a4 reported a cross-site scripting (XSS) attack through the context menu using a data: URL. In this issue, context menu functionality (
    last seen2020-06-05
    modified2014-06-13
    plugin id74693
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74693
    titleopenSUSE Security Update : xulrunner (openSUSE-SU-2012:0924-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-473.NASL
    descriptionSeaMonkey was updated to version 2.11 (bnc#771583) - MFSA 2012-42/CVE-2012-1949/CVE-2012-1948 Miscellaneous memory safety hazards - MFSA 2012-44/CVE-2012-1951/CVE-2012-1954/CVE-2012-1953/CVE-20 12-1952 Gecko memory corruption - MFSA 2012-45/CVE-2012-1955 (bmo#757376) Spoofing issue with location - MFSA 2012-47/CVE-2012-1957 (bmo#750096) Improper filtering of JavaScript in HTML feed-view - MFSA 2012-48/CVE-2012-1958 (bmo#750820) use-after-free in nsGlobalWindow::PageHidden - MFSA 2012-49/CVE-2012-1959 (bmo#754044, bmo#737559) Same-compartment Security Wrappers can be bypassed - MFSA 2012-50/CVE-2012-1960 (bmo#761014) Out of bounds read in QCMS - MFSA 2012-51/CVE-2012-1961 (bmo#761655) X-Frame-Options header ignored when duplicated - MFSA 2012-52/CVE-2012-1962 (bmo#764296) JSDependentString::undepend string conversion results in memory corruption - MFSA 2012-53/CVE-2012-1963 (bmo#767778) Content Security Policy 1.0 implementation errors cause data leakage - MFSA 2012-56/CVE-2012-1967 (bmo#758344) Code execution through javascript: URLs - relicensed to MPL-2.0 - updated/removed patches - requires NSS 3.13.5 - update to SeaMonkey 2.10.1
    last seen2020-06-05
    modified2014-06-13
    plugin id74698
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74698
    titleopenSUSE Security Update : seamonkey (openSUSE-SU-2012:0935-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_FIREFOX-201207-8226.NASL
    descriptionMozillaFirefox have been updated to the 10.0.6ESR security release fixing various bugs and several security issues, some critical. The ollowing security issues have been fixed : - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2012-42) - Benoit Jacob, Jesse Ruderman, Christian Holler, and Bill McCloskey reported memory safety problems and crashes that affect Firefox ESR 10 and Firefox 13. (CVE-2012-1948) - Security researcher Mario Gomes andresearch firm Code Audit Labs reported a mechanism to short-circuit page loads through drag and drop to the addressbar by canceling the page load. This causes the address of the previously site entered to be displayed in the addressbar instead of the currently loaded page. This could lead to potential phishing attacks on users. (MFSA 2012-43 / CVE-2012-1950) - Google security researcher Abhishek Arya used the Address Sanitizer tool to uncover four issues: two use-after-free problems, one out of bounds read bug, and a bad cast. The first use-afte.r-free problem is caused when an array of nsSMILTimeValueSpec objects is destroyed but attempts are made to call into objects in this array later. The second use-after-free problem is in nsDocument::AdoptNode when it adopts into an empty document and then adopts into another document, emptying the first one. The heap buffer overflow is in ElementAnimations when data is read off of end of an array and then pointers are dereferenced. The bad cast happens when nsTableFrame::InsertFrames is called with frames in aFrameList that are a mix of row group frames and column group frames. AppendFrames is not able to handle this mix. (MFSA 2012-44) All four of these issues are potentially exploitable. o CVE-2012-1951: Heap-use-after-free in nsSMILTimeValueSpec::IsEventBased o CVE-2012-1954: Heap-use-after-free in nsDocument::AdoptNode o CVE-2012-1953: Out of bounds read in ElementAnimations::EnsureStyleRuleFor o CVE-2012-1952: Bad cast in nsTableFrame::InsertFrames - Security researcher Mariusz Mlynski reported an issue with spoofing of the location property. In this issue, calls to history.forward and history.back are used to navigate to a site while displaying the previous site in the addressbar but changing the baseURI to the newer site. This can be used for phishing by allowing the user input form or other data on the newer, attacking, site while appearing to be on the older, displayed site. (MFSA 2012-45 / CVE-2012-1955) - Mozilla security researcher moz_bug_r_a4 reported a cross-site scripting (XSS) attack through the context menu using a data: URL. In this issue, context menu functionality (
    last seen2020-06-05
    modified2012-07-23
    plugin id60092
    published2012-07-23
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60092
    titleSuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8226)

Oval

accepted2014-10-06T04:02:24.054-04:00
classvulnerability
contributors
  • nameSergey Artykhov
    organizationALTX-SOFT
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameRichard Helbing
    organizationbaramundi software
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
definition_extensions
  • commentMozilla Thunderbird Mainline release is installed
    ovaloval:org.mitre.oval:def:22093
  • commentMozilla Seamonkey is installed
    ovaloval:org.mitre.oval:def:6372
  • commentMozilla Firefox Mainline release is installed
    ovaloval:org.mitre.oval:def:22259
  • commentMozilla Firefox ESR is installed
    ovaloval:org.mitre.oval:def:22414
  • commentMozilla Thunderbird ESR is installed
    ovaloval:org.mitre.oval:def:22216
descriptionUse-after-free vulnerability in the nsDocument::AdoptNode function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via vectors involving multiple adoptions and empty documents.
familywindows
idoval:org.mitre.oval:def:16984
statusaccepted
submitted2013-05-13T10:26:26.748+04:00
titleUse-after-free vulnerability in the nsDocument::AdoptNode function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via vectors involving multiple adoptions and empty documents.
version38

Redhat

advisories
rhsa
idRHSA-2012:1088
rpms
  • firefox-0:10.0.6-1.el5_8
  • firefox-0:10.0.6-1.el6_3
  • firefox-debuginfo-0:10.0.6-1.el5_8
  • firefox-debuginfo-0:10.0.6-1.el6_3
  • xulrunner-0:10.0.6-1.el6_3
  • xulrunner-0:10.0.6-2.el5_8
  • xulrunner-debuginfo-0:10.0.6-1.el6_3
  • xulrunner-debuginfo-0:10.0.6-2.el5_8
  • xulrunner-devel-0:10.0.6-1.el6_3
  • xulrunner-devel-0:10.0.6-2.el5_8
  • thunderbird-0:10.0.6-1.el5_8
  • thunderbird-0:10.0.6-1.el6_3
  • thunderbird-debuginfo-0:10.0.6-1.el5_8
  • thunderbird-debuginfo-0:10.0.6-1.el6_3